Cross-source coverage
T1601 / ATT&CK
Modify System Image
2 rules across 2 sources.
From MITRE ATT&CK 19.2
Adversaries may make changes to the operating system of embedded network devices to weaken defenses and provide new capabilities for themselves. On such devices, the operating systems are typically monolithic and most of the device functionality and capabilities are contained within a single file.
To change the operating system, the adversary typically only needs to affect this one file, replacing or modifying it. This can either be done live in memory during system runtime for immediate effect, or in storage to implement the change on the next boot of the network device.
- Tactics
- Defense Impairment
- Platforms
- Network Devices
- Telemetry
-
networkdevice:clinetworkdevice:config
How MITRE says to detect it DET0170
Detection Strategy for Modify System Image on Network Devices
Network Devices Analytic 0482
Defenders may observe adversary attempts to alter or replace a network device’s operating system image through anomalous CLI commands, unexpected firmware updates, integrity check failures, or mismatches in version and checksum validation. Suspicious behavior includes modification of image files on storage, OS version output inconsistent with baselines, unexpected reloads or reboots after image replacement, and changes to boot configuration that load non-standard system images.
networkdevice:cliExecution of commands to load, copy, or replace system images (e.g., 'copy tftp flash', 'boot system')networkdevice:configConfiguration changes to boot variables, startup image paths, or checksum verification failures
Sub-techniques with coverage
Counted in the 2 above — a rule tagged a sub-technique covers this technique too.
elastic/detection-rules
1 rule| Detection | Severity | Format |
|---|---|---|
| Kernel Load or Unload via Kexec Detected | Medium | Elastic TOML |
splunk/security_content
1 rule| Detection | Severity | Format |
|---|---|---|
| ESXi Download Errors | Undefined | SPL |